Besides the obvious advantages (you don't need to control the network & have the feature support in hw & have the energy to configure netflow stuff) - host local viewpoint has a lot of advantages vs monitoring from a on-path network element. You can associate stuff to local processes, you don't have the post-NAT warped view of traffic, you can see traffic that doesn't cross routers, you can see the actual traffic contents instead of just metadata, etc.
But the high bit is of course that it's a self-contained normal app and just works.
(And it actually exists unlike the hypothetical netflow version.)
Some good points, and I appreciate there are two semi-disparate domains here. Local interface monitoring addresses a different problem than network monitoring.
I'd argue your advantages perhaps - you do need local root, or at least net_admin / net_raw (I haven't looked to see if TFA drops all but these - perhaps you have?) which raises some security questions. In Linux you may also hit some challenges with promiscuous mode, or capturing on wireless interfaces.
The 'energy' to configure netflow is probably comparable to that required to install and configure this tool. If you don't have the feature on your network hardware, then, yeah, sure, it's moot.
I accept that this, and other existing tools, that let you correlate local processes with local network interface activity can be useful. In my experience it's rare to have to dive into that level, but definitely handy.
In a previous life I would frequently be flipping between Wireshark and Riverbed's Packet Analyzer (nee Pilot) which gives a higher level view than Wireshark. It feels like Sniffnet is aiming to be more in this category, so it's great to have a free software alternative.
For traffic that doesn't traverse routers, you may not know that switches can send netflow. Also, your favourite GNU/Linux distro can send flows.
> (And it actually exists unlike the hypothetical netflow version.)
I don't get this bit.
Are you asserting that netflow monitoring tools don't exist?
But the high bit is of course that it's a self-contained normal app and just works.
(And it actually exists unlike the hypothetical netflow version.)